CAMPUX Cloud Bootcamp The Workbench · Hands-On Labs Contents →
The Workbench
Free · your own subscription
CLI · Bicep · Terraform · torn down
Hands-On Labs

Reading is not doing.

Real builds in your own Azure subscription, driven by the CLI and infrastructure-as-code, verified at every step — then torn down before the bill notices. Mapped to what the jobs actually ask for.

The labs

15 live · full role coverage
L01
First Bicep deploy →
A storage account as code — a what-if preview, then the idempotent re-deploy that makes infrastructure-as-code finally click.
StorageBicep Beginner~25 min$0 free-tier what-if + re-deploy is no-op
L02
Resource Locks →
Protect a resource group with a CanNotDelete lock, prove it blocks a real delete, then remove it and watch the same command succeed.
Resource ManagerCLI Beginner~20 min$0 free-tier delete blocked, then allowed
L03
RBAC & Managed Identity →
An App Service reads a Key Vault secret through a managed identity and a least-privilege role — zero credentials anywhere in the code.
App ServiceKey VaultEntra IDBicep Intermediate~35 min$0 free-tier secret resolves via MSI
L04
App Registration & OIDC SSO →
Register an app in Microsoft Entra ID and wire single sign-on — staff sign in with Microsoft, not one line of auth code written.
Entra IDApp ServiceCLI Intermediate~40 min$0 free-tier browser sign-in succeeds
L05
RBAC with Security Groups →
Assign a role once to an Entra security group and manage access at scale through membership — the pattern real teams actually run.
Entra IDRBACCLI Intermediate~30 min$0 free-tier access follows membership
L06
Azure Policy as code →
Author a custom policy that denies public-blob storage, watch it block a bad resource, then ship it as code with Bicep.
Azure PolicyStorageBicep Advanced~40 min$0 free-tier non-compliant deploy denied
L07
Terraform landing zone + remote state →
Provision a landing zone with Terraform, then migrate state to a locked backend in Azure Storage — plan, apply, and the state lease that makes it team-safe. The IaC tool every posting names.
StorageResource ManagerTerraform Intermediate~40 min$0 free-tier concurrent apply lock-refused
L08
GitHub Actions + OIDC — zero stored secrets →
Federate GitHub Actions to Entra ID so a workflow deploys to Azure with no stored secret — short-lived tokens, a scoped role, and an app registration with zero credentials. Exactly as jobs 1–3 describe.
Entra IDApp RegistrationGitHub Actions Intermediate~40 min$0 free-tier deploy runs, 0 secrets stored
L09
Hub-and-spoke networking & segmentation →
A hub, two isolated spokes, VNet peering and NSGs that enforce least-privilege connectivity between workloads — the landing-zone network backbone, proven from the routing, with no VMs to bill.
Virtual NetworkNSGCLI Intermediate~35 min$0 no VMs spokes non-transitively isolated
L10
Observability: Log Analytics & a KQL alert →
Stream the Activity log into a Log Analytics workspace, query it in KQL, and fire a scheduled-query alert through an action group — the monitoring loop every posting lists, on free-tier ingestion.
Azure MonitorLog AnalyticsKQL Intermediate~35 min$0 free-tier KQL returns · alert enabled
L11
Build & govern an MCP server on Azure →
Ship a Model Context Protocol server to Container Apps over streamable HTTP, connect a client that lists and calls its tool, then govern both sides — a managed identity for secret-free outbound, Entra ID built-in auth that 401s anonymous callers. The differentiator skill in senior 2026 postings.
Container AppsEntra IDManaged IdentityPython Advanced~50 min~$0 scale-to-zero client calls tool · anon gets 401
L12
Grounded RAG on Azure AI Search →
Embed documents with Azure OpenAI, store and search them as vectors in a free-tier AI Search index, and return grounded answers with citations — then prove the hard part: it refuses to answer what isn't in the source data. RAG exactly as job 3 spells it out.
AI SearchAzure OpenAIEmbeddingsPython Advanced~50 min$0 free tier + pennies cited answer · refuses off-corpus
L13
Container Apps + ACR: managed-identity pull, scale-to-zero →
Run a container on Azure Container Apps, pulling the image from ACR with a managed identity (admin account disabled) and scaling to zero when idle — the container pattern most workloads want, without the AKS bill.
Container AppsACRManaged IdentityCLI Intermediate~35 min~$0 scale-to-zero app 200 · min-replicas 0 · no admin creds
L14
Cost guardrails: budgets, Advisor & lifecycle →
Set a Cost Management budget with an 80% email alert, read Azure Advisor right-sizing recommendations, and apply a storage lifecycle policy that tiers and expires blobs automatically — cost optimization as controls you deploy.
Cost ManagementAdvisorStorageCLI Beginner~30 min$0 guardrails budget set · lifecycle tiers + expires
L15
App Service Environment, read as code →
A concept lab you read, not run: understand the single-tenant, VNet-isolated App Service Environment v3 by reading its four-resource Bicep — delegated subnet, ASEv3 stamp, Isolated v2 plan, private app — and compiling it offline. An ASE bills even when empty, so you learn the architecture and the cost model for $0, and when a private endpoint on a normal Web App is the cheaper right answer.
App Service EnvironmentVNetBicep Intermediate~25 min read$0 read-only bicep build compiles · nothing deployed
Advanced builds — a tier up

Longer, costlier, closer to the real thing

Multi-hour, expert-level builds that run real infrastructure — expect a few dollars of Azure spend, not free tier, and set a budget alert first. Each ends the way the job does: with something you can prove works, then tear down. Do them once you're comfortable with the labs above.

AB1
Zero-Trust on AKS: workload identity, Key Vault & network policy →
Run a workload on AKS with zero static secrets — a Kubernetes ServiceAccount federated to an Azure Managed Identity, reading Key Vault just-in-time — then default-deny the namespace network and prove an unlisted pod is blocked. Zero trust, deployed rather than described.
AKSWorkload IdentityKey VaultNetwork Policy Expert~5–6 hrs~$3–6 real spend pod reads secret, no creds · probe BLOCKED
AB2
AKS disaster recovery: Velero, GRS & a cross-region restore →
Back up a stateful AKS workload with Velero to geo-redundant storage, lose the cluster on purpose, restore into a second region, and prove the data is byte-perfect by checksum — then automate the whole drill weekly in GitHub Actions with measured RTO/RPO.
AKSVeleroGRS StorageGitHub Actions Advanced~5–6 hrs~$10–20 real spend checksum matches cross-region · drill green
AB3
GitOps on AKS: ArgoCD, Helm & an Azure DevOps sync →
Make the cluster take orders from Git, not your laptop: install ArgoCD, promote one Helm chart across dev/qa/prod by values file, roll back a bad deploy automatically, and wire an Azure DevOps pipeline that ships by committing desired state — no pipeline ever touches kubectl.
AKSArgoCDHelmAzure DevOps Advanced~4–5 hrs~$4–8 real spend merge deploys · bad deploy self-heals
Build queue — cleared

Every lab off the job descriptions is shipped

The full spine of a modern Azure cloud-engineer role is now live above: IaC in Bicep and Terraform, OIDC pipelines, landing-zone networking, observability, containers, cost, and the AI-platform work — MCP governance and grounded RAG — that senior 2026 postings ask for. New labs still land here as the postings evolve.

New to Azure? Set up your machine first

A one-time, 15-minute setup: a free Azure account, the Azure CLI and Terraform (winget / brew / apt), and az login — then every lab just works. Or skip installs entirely with Azure Cloud Shell.

Start here →
One public repo — clone and go

Each lab is a folder: the step-by-step guide, an IaC template, and any starter code. Open a terminal (or shell.azure.com), clone github.com/kloudcaptain/campux-labs, follow the README.

View the repo →

CostLive labs use free-tier resources and pennies of storage — but the teardown at the end of each is not optional. Confirm the resource group is gone before you close the tab.
AccessIdentity and governance labs create users, groups, and role assignments — run them in a personal test tenant where you are admin, not your employer's subscription, where the guardrails will (correctly) refuse you.